using System.Security.Cryptography;
using IdentityShroud.Core.Model;

namespace IdentityShroud.Core;

public class RsaJwtSigner : IJwtSigner
{
    public IReadOnlyList<JwtSigAlgName> Algorithms => [JwtSigAlgName.RS256, JwtSigAlgName.RS384, JwtSigAlgName.RS512];

    // +-------------------+---------------------------------+
    // | "alg" Param Value | Digital Signature Algorithm     |
    // +-------------------+---------------------------------+
    // | RS256             | RSASSA-PKCS1-v1_5 using SHA-256 |
    // | RS384             | RSASSA-PKCS1-v1_5 using SHA-384 |
    // | RS512             | RSASSA-PKCS1-v1_5 using SHA-512 |
    // +-------------------+---------------------------------+

    public byte[] CalculateSignature(JwtSigAlgName algName, DecryptedSigningKey key, ReadOnlySpan<byte> jwt)
    {
        using var rsa = RSA.Create();
        rsa.ImportPkcs8PrivateKey(key.KeyData, out int _);
        var sig = new byte[rsa.KeySize / 8]; 
        rsa.SignData(jwt, sig, GetHashAlgorithmName(algName), RSASignaturePadding.Pkcs1);
        return sig;
    }

    private static HashAlgorithmName GetHashAlgorithmName(JwtSigAlgName algName)
        => algName.Name switch
        {
            "RS256" => HashAlgorithmName.SHA256,
            "RS384" => HashAlgorithmName.SHA384,
            "RS512" => HashAlgorithmName.SHA512,
            _ => throw new ArgumentException("Invalid algorithm for RsaJwtSignatureProvider")
        };

}